ISIS Secret Cyber Terrorism Forum Exposed

The forum reflects ISIS hackers' growing desire to wage war online

Hundreds of Islamic State supporters have flocked to an online channel dedicated to providing tools needed to wage campaigns of cyber terror across the Internet.

More than 300 people now belong to an IS-affiliated forum filled with users swapping material on how to target and hack into vulnerable networks and computer systems. Deep Web research firm Vocativ discovered the jihadi e-academy on Telegram, a social messaging app that ISIS supporters have used previously to share instructions on how to make explosive devices, hand grenades, suicide belts and Molotov cocktails.

“This channel is dedicated to publishing courses of hacking and programming languages for the supporters of the Caliphate on the Internet,” reads the forum, which was formed on Nov. 24—less than two weeks after ISIS militants waged an orchestrated massacre in the streets of Paris.

Cyber security experts who reviewed some of the hacker material shared on Telegram said that it doesn’t provide the type of know-how required to carry out the kind of catastrophic cyber attack that many of these experts say is possible. The experts also conceded, however, that it reflects the group’s budding desire to wage increasingly sophisticated warfare online.

“Can they do damage? Sure,” said Herb Lin, a Senior Research Scholar for Cyber Policy and Security at Stanford University. “Can they do the kind of damage that causes all of the lights to go out in New York City? That’s much more difficult to discern.”

The bulk of material published on the ISIS hacker forum consisted of videos and content offered for free elsewhere online. Users, for example, recently shared a free, 27-part course on penetration testing, a practice that involves testing a computer system or network for vulnerabilities that a hacker can exploit.

Nearly all of the tutorials reviewed by Vocativ focused on similar skill sets. Experts said they alone are not enough to do serious damage. “Once you get inside a system you need to know what to do,” said Lars Hilse, a digital strategy consultant who authored a report on cyber terrorism last year. “That requires a certain degree of cleverness that, by itself, presents a hurdle to most people.”

The track record among hackers who claim to be affiliated with ISIS has not displayed that level of proficiency. ISIS supporters failed to follow through on threats they made to infiltrate US security on the anniversary of 9/11 this year and an attempt this month to dox US Senate Minority Leader Harry Reid relied on publicly available information, much of which was outdated or inaccurate, Vocativ found.
    
One of the more celebrated cyber attacks claimed by ISIS came in January when members of its so-called “Cyber Caliphate” managed to hack into US Central Command’s Twitter account. No actual Pentagon network or internal system was breached.

Such achievements are a far cry from any ability to cripple entire financial, military and communication systems, which analysts claim is feasible. And they pale in comparison to some of the recent cyber attacks conducted against the US by hackers based in China and Iran, who have managed to breach government data and gain access to American utility networks.

Yet to dismiss the desire among ISIS supporters to commit “cyber jihad” would be wrongheaded, said Alan Brill, a senior managing director at Kroll, a security consulting firm. Brill and other experts have warned for years that networks containing access to critical information and infrastructure are vulnerable. With a group as well-funded, well-organized and as committed to terror as ISIS on the scene, that’s enough to sound the alarm bells.

“If you just think about the interplay of rising hacker skills on the part of terrorists like ISIS and poor security it leads to the conclusion that there’s a significant amount of risk,” Brill told Vocativ. “To be honest, it scares me.”

Hilse said his own fears were realized in April when a group of hackers brought down a television network in France and infiltrated its website and Facebook page. The hackers claimed allegiance to the Islamic State. If it is proven that ISIS was behind the attack, it would signify a new level of sophistication for the terror group, albeit one that it has not demonstrated since.

“It would mean that ISIS is capable of breaching the cyber-physical threshold and actually getting into the real world,” Hilse said. While he’s cautious about giving credit to ISIS, it still remains a wakeup call.
“I know what the possibilities are if the dots are connected,” he said. “The damage can be potentially dire to our Western way of life.”

Vocativ: http://voc.tv/1VB6ilh

« Biggest Cybersecurity Threats In 2016
Google Chief Says UK Leads In E-commerce »

CyberSecurity Jobsite
Check Point

Directory of Suppliers

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

Resecurity

Resecurity

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

The PC Support Group

The PC Support Group

A partnership with The PC Support Group delivers improved productivity, reduced costs and protects your business through exceptional IT, telecoms and cybersecurity services.

iTrinegy

iTrinegy

iTrinegy is a world leader in Application Risk Management offering solutions to mitigate all networked application deployment risks

MailGuard

MailGuard

MailGuard delivers a full suite of security solutions across email and web to protect your business before threats reach your environment.

CyberDefcon

CyberDefcon

CyberDefcon is an independent organization dedicated to the pursuit of making the internet a safer place.

European Recruitment

European Recruitment

European Recruitment is an award-winning, international recruitment agency specialising in niche technology areas including Cyber Security.

WeSecureApp (WSA)

WeSecureApp (WSA)

WeSecureApp is specialized in providing Cyber Security Solutions to safeguard your applications and networks.

Blake, Cassels & Graydon (Blakes)

Blake, Cassels & Graydon (Blakes)

Blakes is one of Canada’s top business law firms serving national and international clients in specialist areas including cyber security.

Block Armour

Block Armour

Block Armour is a Mumbai and Singapore based venture focused on harnessing emerging technologies to counter growing Cybersecurity challenges in bold new ways.

ODSC

ODSC

ODSC is a security systems integrator that provides services and expertise in identity management and access.

Desec Security

Desec Security

Desec's training platform allows professionals around of the world to acquire knowledge and practical experience in Information Security.

Britive

Britive

The Britive Platform is a cloud-native security solution built for the most demanding cloud-forward enterprises.

Cynance

Cynance

Cynance are an award-winning, independent cyber security specialist and part of the Transputec family of companies.

Darkscope

Darkscope

Darkscope is an award-winning personalised cyber intelligence service provider. Our cutting-edge AI and Deep Artificial Neural Networks lead the world of cyber intelligence solutions.

Defimoon

Defimoon

DeFimoon is the International Blockchain Development & Security Agency. We provide professional services and solutions at the highest quality on world-leading chains.

Quotient

Quotient

Quotient builds digital experiences that empower and inspire the American people by understanding their needs, simplifying complex technical solutions and adapting to how they work, live and learn.

E-CQURITY (ECQ)

E-CQURITY (ECQ)

ECQ is a network security company offering offensive security services and solutions focused on active offensive and defensive positioning.

Cythera

Cythera

Cythera is an Australian cyber security company with in-house cyber security professionals providing world-class cyber protection to medium to large companies all over Australia.